On 24 February 2026 the ICO fined Reddit £14.47m.[23] The reason was not a dramatic hack. It was a set of failures around children: the platform used children's personal data unlawfully, had not done a proper assessment of the risks to children, and relied on age checks that did not really work. A separate penalty hit another platform, Imgur's owner, for similar reasons.[23]
You may run nothing like a social network. The case still matters, because it shows how the regulator is now thinking.
What the regulator is signalling
The clearest message is about age checks. Simply asking a user to tick a box that says "I am over 18" is no longer enough where children could be at risk.[24]
In March 2026, the ICO and Ofcom set out shared expectations on age assurance and pointed to methods that actually do something, such as facial age estimation, digital ID, or one-time photo matching.[24] Self-declaration on its own is treated as a token gesture.
The second message is about effort before the fact. Reddit was penalised partly for not assessing the risks to children before launching features that affected them.[23] The regulator expects you to think first, not to apologise later.
Why this reaches ordinary businesses
Plenty of ordinary businesses touch children's data without thinking of themselves as "children's services": a tutoring service, a sports club, a family-focused shop, an app with younger users.
If children can realistically end up in your data, the same logic applies. Know that they are there, take extra care with their information, and do not pretend a checkbox is an age check when it is not.
What this means for you
Ask one honest question: could under-18s be among the people whose data we hold or whose accounts we run?
If the answer is no, and you have good reason to believe it, keep a note of that reasoning. If the answer is yes, or maybe, then treat children's data with extra care, make sure any age check is more than a tick-box, and think through the risks before you launch something new rather than after.
The fines went to big platforms. The principle behind them applies to anyone.